Skip to content
CertGPS

Security+ First, or the CISSP Exam Early as an Associate of ISC2?

Comparison

There is no CISSP Associate exam. Compare Security+ with passing CISSP early as an Associate of ISC2, and see how Security+ takes a year off CISSP's five.

Published
Updated
Read time
5 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

Security+ First, or the CISSP Exam Early as an Associate of ISC2?

Security+ costs $439 and certifies what a security or systems administrator does in the first couple of years. The other half of this pairing isn't a certification at all. It's the Associate of ISC2, the designation you hold after passing the full CISSP exam before you have the five years of experience CISSP requires. One fact settles most readers' choice: Security+ is on ISC2's list of credentials that waive one of those five years, so it shortens the road to CISSP whichever exam you sit first.

The two exams in one table

Security+CISSP exam, held as Associate of ISC2
IssuerCompTIAISC2
FormatMultiple choice and performance-based itemsComputerized adaptive test; multiple choice and advanced item types
QuestionsUp to 90100 to 150
Time90 minutes3 hours
Passing score750 on a 100–900 scale700 out of 1000
Price$439 voucher (US list)$749 standard registration (Americas)
ExperienceNone required; Network+ and two years as a security or systems administrator recommendedNone to sit; five years in two of eight domains to become a CISSP, earned within six years
Current versionSY0-701; SY0-801 launches November 17, 2026Outline in effect since April 15, 2024
Upkeep50 CEUs and a $150 fee per three-year cycle$50 a year and 15 CPE credits a year

Where each one fits in a career

Security+ suits the help desk analyst, system administrator or network technician who already handles some security work, and anyone applying for a first analyst job that names it. CompTIA maps it to US Defense Department 8140 work roles including cyber defense analyst, incident responder, vulnerability analyst and security control assessor, which matters if you work on a defense contract.

The associate route suits someone further along: three or four years in, doing work that already crosses several CISSP domains, perhaps studying for CISSP already, and keen to pass while the material is fresh. It suits a student much less well. Six years is the most ISC2 allows to earn the five years of experience, and you pay $50 a year throughout for a badge that, in ISC2's own words, shows you passed "one of our rigorous exams" without saying which.

On defense work the difference is sharper. ISC2 lists CISSP as approved under DoDM 8140.03, but neither its CISSP page nor its November 2024 announcement that all its certifications are approved under DoD 8140 says anything about associates. Until your security office confirms otherwise, assume a role that requires CISSP needs the certification itself.

What each exam asks of you

Security+ tests whether you can pick the right control or setting in a short scenario. Security Operations carries 28% of the current SY0-701 exam, and that domain holds most of the "Given a scenario" objectives: adjusting firewall and email security settings, setting up identity and access controls, using log data in an investigation. Performance-based items ask you to work through a task rather than pick an answer, so time at a keyboard pays off.

CISSP asks what a security manager should do. Security and Risk Management carries 16%, the heaviest of eight domains, and its objectives use verbs like establish, evaluate and develop: set up a security awareness program, apply supply chain risk management, implement business continuity requirements. It also covers material Security+ doesn't list at all, such as the Biba and Bell-LaPadula security models. The adaptive format adds pressure of its own, since you can't go back to an earlier question and several options are often defensible. A candidate with two years of hands-on work may know the technical answer and still miss the one ISC2 wants for the organization.

How the two fit together

Sitting Security+ first doesn't delay CISSP. Pass Security+ in your second year, and once you have four years of qualifying work you can sit CISSP and apply straight away, with no associate stage at all. The waiver is one year whichever approved credential or degree you hold, and only one year can be waived, so Security+ plus a computer science degree still leaves four years to earn.

Passing CISSP first works too. Security+ earned later still takes a year off when you apply to upgrade, since ISC2 checks your experience, waiver included, when you apply for endorsement. Either way, the upgrade costs the $85 difference between the associate fee and the $135 member fee.

Renewal overlaps once you're a full CISSP. CompTIA's Security+ renewal list accepts CISSP for 50 continuing education units, the whole three-year requirement. That applies to the certification, so an associate can't use it, and CompTIA's fee-free renewal routes (passing the latest exam, a higher CompTIA certification, CertMaster CE) don't include another vendor's credential, so expect to pay the $150 fee.

If you're booking Security+ this autumn, choose the version first. SY0-801 launches on November 17, 2026, and the English SY0-701 retires on June 11, 2027.

Our view

Under three years into security work, we'd take Security+ first. It costs $439, CompTIA maps it to DoD 8140 work roles, and it takes a year off CISSP, which may mean you never need the associate stage. The associate route makes sense in a narrow window: you're within a year or two of qualifying, you already hold Security+ or a degree, and you'd rather bank the hardest exam now than study for it again later. The opposite view, sitting CISSP as early as you can pass it because the exam only gets harder to find time for, is fair if you can afford $749 for a result you can't yet call CISSP.

Our Security+ and CISSP comparison covers the full certification, and SSCP against the associate route covers ISC2's own one-year option.

Sources (13)